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COUNTY OF KING 


AFFIDAVIT 



JUN 1 2 2007 u 



b 


Nonnan B. Sanders Jr., being duly sworn on oadi, deposes and says: 

1 . I am a Special Agent for the Federal Bureau of Investigadon (“FBr), and 
have been such for die past five years. Prior to becoming a Special Agent, I was 
employed by the FBI as a Computer Forensic Examiner, for six and one-half years. 1 
am currently assigned m die Seattle Office’s Cyber Crime Squad, which investigates . 
various computer, and Internet-related federal crimes. 

« 4 

2. My experience as an FBI Agent has included the investigation of cases 

« 

involving Computer Intrusions, Extortion, Internet Fraud, Identity Theft, Crimes 

F 

Against Children, Intellectual Property Rights, and other federal violations involving 
computers and the Internet. I have also receive specialized training and gained 
experience in interviewing and interrogaUon techniques, arrest procethires, search 
warrant applicadons, the execudon of searches and seizures, cyber crimes computer 

ft 

ft 

evidence idendfication, computer evidence seizure and forensic processing, and various 

odier criminal laws and procedures. I have personally participated in the execution of 

arrest warrants and search warrants involving the search and seizure of computers and 

• » ‘ 
electronic evidence, as well as paper documents and personal belongings. 

ft 

3. I am an investigative or law enforcement officer of the United States 
within the meaning of Section 2510(7) of Title 18, United States Code, in that I am 
empowered by law to conduct investigations and to make arrests for f^eral felony 

ft * 

offenses. 

t 

4. Relative to this investigation, my duties include the investigation of 
offenses including violations of Title 18, United States Code, Sections 875(c) (Interstate 

ft 

Transmission of Communication Containing Threat to Injure), and 1030(a)(5)(A)(i) and 
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(B)(iv) (Computer Intrusion Causing a Threat to Public Safety). 

5 . , I submit diis affidavit in support of the application of the United States for 

a search warrant. This search warrant pertains to the Government's planned use of a 
specialized technique in a pending criminal investigation. Essentially, if a warrant is 
approved, a communication will be sent to the computer being used to administer 
w w w . mvspace . com ‘ (“MySpace") user account “Tlmberlinebombinfo" . 

. The communicadon to be sent is designed to cause die above referenced 

’ « 

conqiuter to transmit data, in response, that will identify the computer and/or the 

r • * 

r 

user(s) of the coxnputer.^ In this manner, the FBI may be able to identify the computer 
and/or user of the computer that are involved in committing cr iminal violations of 


11 

12 


United States Code specifically. Title 18, United States Code, Sections 875(c) 
(Interstate Transmission of Communication Containing Threat to Injure), and 



1030(a)(5)(A)(i) and (B)(iv) (Computer Intrusion Causing a Threat to Public Safety). 
More specifically, the United States is applying for a search warrant authorizing: 

» 

a). the use of a Computer & Internet Protocol Address^ (“IP address”) 


MySpace is a international free service that uses the Internet for online communication dirough 
an interactive social network of photos, videos, weblogs, user profiles, blogs, e-mail, instant 
messaging, web forums, and groups, as well as other media formats. MySpace users are capable of 
customizing their user webpage and profile. Users arc also capable of searching or browsing other 
MySpace webpages and adding other users as “friends”. If the person identified approves your 
“friend” request, he or she will be added to your list of friends. Users are capable of sending MySpace 
messages and posting comments on other user’s MySpace webpages. 

2 

In subOfiitting this request^ the Government req>ectfully does not concede that a reasonable 
expectation of privacy exists in the internet protocol address ^signed by a network service provider or 
other provider to a specific user and used to address and route electronic communications to and from 
that user. Nor does the government concede chat a reasonable expectation of privacy is abridged by the 
use of this communication technique, or that the use of this technique to collect a computer’s IP 
address, MAC address or other variables Chat are . broadcast by the computer whenever it is connected 
to the Internet, constitutes a search or seizure. 

^ Conceptually, IP addresses are similar to telq)hone numbers, in that they are used to identify 
conq>uters that exchange information over the Internet. An IP address is a unique numeric address 
used to direct information over the Internet and is a series of four numbers, each in the range 0-255, 
separated by periods (e.g., 121.56.97.178). In general, information sent over dte Internet must 
contain an originating IP address and a destination IP address, which identify the computers sending 
and receiving the information. Section 216 of the USA Patriot Act (P.L. 107-56) amended 18 U.S.C. 
§§3121 et seq to specifically audiorize the recovery of “addressing” and “routing” informatibn of 
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9 



Verifier (“CIPAV") in conjunction with any computer that admiiiisters MySpace user 
account “TimberJinebombinfo* flittD://www.mvsDace.com/timberlmebombinfo) . 
without prior announcement within ten days from the date this Court authorizes the use 
oftheCIPAV: 


b) . that the CIPAV may cause any computer - wherever located - that 
activates any CIPAV authorized by this Court (an “activating computer”) to send 
network level messages* containing die activating computer’s IP address and/or MAC 

4 

address,’ other environment variables, and certain registry-type information‘s to a 

b 

computer controlled by the FBI ; 

c) . that the FBI may receive and read within ten days from the date 

diis Court authorizes the use of the CIPAV, at any time of day or night, the information 
that any CIPAV causes to be sent to the computer controlled by the FBI; and 

d) . dial, pursuant to 18 U.S.C. §3103a(b)(3), to satisfy the notification 


ilectronic As used here, a network-level message refers to an exchange of technical informatioh 
letweea computers, communications by a pen register/trap & (race order. 


Such messages work in established network protocols, determining, for example, how a given 
communication will be sent and received. Every time a computer connected to a loc^ area network 
(LAN) or to the Internet connects to another computer on the LAN or the Internet, it broadcasts 
network-level messages, including its IP address, and/or media access control.(MAC) address, and/or 
other “enviromiKnt variables. ” A MAC address is an unique numeric address of the network interiace 
card in a computer! Enviroiunent variables that may be transmitted include; operating system type and 
version, browser type and version, the language the browser is using, etc. These network-level 
messages also often convey network addressing information, including origin and destination 
information. Network-level messages are to make networks operate properly, transparently, and 

consistently. 




Con^ttters that access, and communicate on LANs do so via a network interface card (NIC) 
installed in the con^uter. The NIC is a hardware device and every NIC contains its own unique MAC 
address. Every time a computer connected to a LAN communicates on the LAN, the computer 
broadcasts its MAC address. 

° As used here., “registiy-type information” refers to information stored on the internal hard 
drive of a computer that defmes that computer’s configuration as it relates to a user’s profile. This 
information includes, for example, die name of the registered owner of the computer and the serial 
number of the operating system software installed. Registry information can be provided by a 
computer connected to the Internet, for example, when that computer cormects to the Internet to request 
a software upgrade from its software vendor. 
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requirement of Federal Rule of Criminal Procedure 41(f)(3), the FBI may delay 
providing a copy of the search warrant and the receipt for any property taken until no 
more than thirty (30) days after sudi tim e as the name and location of the owner or user 
of the activating computer is positively identified or a latter date as the court may, for 
good cause shown, authorize. Provision of a copy of the search warrant and receipt 
may, in addition to any other methods allowed by law, be effectuated by electronic 
delivery of true and' accurate electronic copies (e.g. Adobe PDF file) of the fully 
executed documents. 

$ 

6. lam thoroughly familiar with the information contained in this Affidavit, 

k 

which I have learned through investigation conducted with other law enforcement 
officers, review of documents, and discussions with computer experts. Because this an 
application for a search warrant and pen register, not every fact known about the 

« 4 

investigation is set forth, but only those that are pertinent to the application. As a result 

r 

of the investigation, I submit there is probable cause to believe the MySpace 




Tiraberlinebombinfo” account, e-mail account 



il.com”; e-mail 


account “dougbri^s@gmail .com ” ; e-mail account Mougbrigps234@gmail . com” : e-mail 

s 

account “thisisfromitalv@gmail.com" : and e-mail account 

“ttmberline. sucks@gmail. com ” have been used to transmit interstate communications 
containing threats to injure , and involve computer intrusion causing a direat to public 
safety in violation of Title 18, United States Code, Sections 875(c) and 1030(a)(5)(A)(i) 
and (B)(iv). I further submit that there is probable cause to believe that using a CIPAV 
in conjunction with the target MySpace account (Timberlinebombinfo) will assist in 
identifying the individual(s) using the activating computer to commit these violations of 
the United States Code. 


25 


26 


27 


7. 


In general, a CIPAV utilizes standard Internet computer commands 


commonly used commercially over local area networks (LANs) and the Internet to 
request that an activating computer respond to the CIPAV by sending network level 


23 
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messages^ and/or other variables, and/or registry information, over the Internet^ to a 
computer controlled by the FBI. The exact nature of these commands, processes, 
capabilities, and their configuration is classified as a law enforcement sensitive 

4 « 

investigative technique, the disclosure of which would likely jeopardize other on-going 
investigations and/or future use of the technique. As such, the property to be accessed 
by the CIPAV request is the portion of the activating computer that contains 
environmental variables and/or certain registry-type information; such as die 

computer’s true assigned IP address, MAC address, open communication ports, list of 

» 

running progr^s, operating system (type, version, and serial mimber), internet 

browser and version, language encoding, registered computer name, registered 

% 

n 

company name, current logged-in user name, and Uniform Resource Locator (URL) 

that the target computer was previously connected to. 

« * 

4 w 

8. An Internet Service Provider (ISP) normally controls a range of several 
hundred (or even thousands) of IP addresses, which it uses to identify its customers’ 
computers. IF addresses are usually assigned "dynamically"; each time die user 
connects to the Internet, the customer' s computer is randomly assigned one of the 
available IP addresses controlled by the ISP. The customer’s computer retains tiiat IP 
address until the user disconnects , and the IP address cannot be assigned to another 
user during that period. Once the user disconnects, however, that IP address becomes 
available to other customers who connect thereafter. ISP business customers will 
commonly have a permanent, 24-hour Internet connection to which a "static" (i.e., 

9 

tixed) IP address is assigned . Practices for assigning IP addresses to Internet users 
vary, with many providers assigning semi-persistent numbers that may be allocated to a 

4 

single user for a period of days or weeks. 

9 . Every time a computer accesses the Internet and connects to a web site. 


The "Internet” is a global computer network, which electronically connects computers and 
allows communications and transfers of data and information across state and national boundaries. To 
gain access to the Internet, an individual utilizes an Internet Service Provider (ISP). These ISP’s are 
available worldwide. 
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14 


15 


16 


17 


18 


that computer broadcasts its IP address along with other environment variables. 

4 

Enviromnent variables, such as what language die user is communicating in, allows the 

• r ^ 

web site to communicate back and display information in a format that the conqiuter 

w 

accessing the web site can understand. These environment variables, including but not 
limited to, the IP address and the language used by the con^uter, may assist in locating 
the computer, as well as provide information that may help identify the user of the 
computer. 

10. The hard drives of some computers contain registry-type information. A 

• r 

registry contains, among other things, information about what operating system 

♦ 

software and version is installed, the product serial number of that software, and. the 

name of the registered user of the computer. Sometimes when a computer accesses the 

< 

Internet and connects to a software vendor's web site for the purpose of obtaining a 

P 

software upgrade, the web site retrieves the computer's registry information stored on 

its internal hard drive. The registry information assists the software vendor in 

• ■ 

determining if that conqiuter is miming, among odier information, a legitimate copy of 

* k 

their software because the registry information contains the software's product 
registration number. Registry information, such as the serial number of the operating 
system software and the computer's registered owner, may assist in locating die 


19 


computer and identifying its user(s) . 


20 


21 


THE INVESTIGATION 


22 

23 

24 

25 

26 

27 

28 


11. On May 30, 2007, a handwritten note was discovered on the premises of 
the Timberline High School in Lacey, Washington. Subsequently, school 
admini^ators ordered an evacuation of the students based on the handwritten-bomb 
threat note. 

a). On June 4, 2007, Timberiine High School received a bomb threat 

> 

e-mail from sender: “ douebriggsl23@gmail.com” . The Unknown Subject(s) 

I (UNSUB) stated in the e-mail “I will be blowing up your school Monday, June 4, 

^ * 
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2007. There are 4 bombs planted throughout timberline high school. One in die math 
hall, library hall, main office and one portable. The bombs will go off in 5 minute 

4 

intervals at 9:15 AM.” In addition, the UNSUB(s) stated, “The email server of your 
district will be offline starting at 8:45 am.” The UNSUB(s) launched a Denial-of- 

k 

Service (DOS)* attack on the Lacey School District computer network, which caused 
over 24,000,(X)0 hits on the system within a 24 hour period. School administrators 
ordered an evacuation of the school on June 4, 2(X)7. 

b). On June 5, 2007, the UNSUB(s) sent an e-mail from 

k 

“dougbrigs@gmail.com” stating the following: . 

< < Read This ASAP> > 

Now that the school is scared from yesturdays fake bomb threat it’s 
now time to get serious. One in a gym locker, the girls. It’s in a 
locker hidden under a pile of clothes. The other four I will only 
say the general location. One in the Language Hall, One in the 
math hau. One undeineath a portable mp^ with strong ducktape. 

mb will go off if anv vibrations are felt. And the last one. 


This bomb wm g 
Is in a locker. It 


any > 

is enclosed in a soundnri 


, and litteraly 


undetectable. I have used a variety of chemicals to make the 
bombs. They are all different kinas. 


go 

ll^th: 


UNSUB(s) 


: police officers and technology idots at the district 
this email and yesturdays email’s location. I can 


Oh and for the 

office trying to track 

give you a Bint. The email was sent over a newly made gmail 
account, from overs^ in a foreign country. The gmail account was 
created there, and this email and yesturdays was sent from there. So 
good luck talking with Itzdy about getting the identify of the person 
who owns the lOOMbit dedicated server • 


22 


23 


24 


25 


26 


27 


28 


c) . In another e-mail from sender “dougbriggs234@gmail . com” 


the UNSUB(s) states the following: 


I 

Hello Again.- Seeing as how ymi’re too stupid to tr 
back lets get serious. ” [The UNSUB(s) mentions o bombs 


trace the email 
set to . 


8 


A DOS attack is an Internet based computer attack in which a compromised system attacks a 
single target, thereby causing a denial of service for users of the targeted computer system. The flood 
of incoming messages to the target system essentially forces it to shut down, thereby denying service to 
the system to legitimate users. The DOS attack is generally targeted at a particular network service, 
such as e-mai] or web access. 
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detonate between 10:45-11:15 AM, and adds] Seriously, you are 
going to catch me. So Just give up. Maybe you should hire 
Gates to tell you that it is corning from Italy. HAHAHA Oh 
already told you that. So stop pretendiiw to be “tracing it” 
have already told you it’s coming from i^y. That is 
will stop so just stop trying. Oh and this email will be 
proxy behina tiie Italy server. 


10 


12 


13 


14 


15 


16 


17 


18 


19 


20 


21 


22 


23 


25 


26 


aly. That is 

email will be 


are not 
Bill 
wait I 
because I 
where trace 
behind a 


d) . School administrators ordered an evacuation of the school on June 

5. 2007, 

e) . On June 6, 2007, Principle Dave Lehnis of Timberline High 


School received an e-mail from sender: “dougbriggs91 l@gmail. 
contained the following text: “ENJOY YOUR LIFE ENDING”. 

f) . In another e-mail from “dougbriggs91 l@gn 


” . The e-mail 


” the 


UNSUB(s) states the followin g , 

Well hello Timberline, today is June 6, 2007 and I”M just emailing 
you today to say that school will blow up and that’s filial! There 
are 2 bombs dus time Hran short on mon^ to Buy things at home 
depot). They will go off at exactly 10:45:00 AM. One is on 
located on a portable. And the omer is somewhere else. Keep 

trying to ’trace’ this email. The only thing you will be able to 
track is that it came from Italy. There is no other information that 
leads it back to the United States in any way so get over it. 

You should hire Bill Gales to track it for you. HAHAHAHA. He 
will just tell you that it came from over seas, so if you have close 
relations with the POPE you might get some information. But 
other than that, have fun looking in Italy. :-) 

Also, stop advising teachers to no show this email to classmates. 
Eve^one would be ammused by this email and I might stop if you 
do. Funny how I can trick you ml into thiiddng that I included my 
name to ^w that it isn’t me, because who the hell would put their 
name? Or is that just what I want you to think. 

And yet again, this email was sent from overseas to a newly made 
email account that has 

already been deleted of all information by the time you read this 
email. Get your ass on a plane to Italy ii you want it to stop. 

g). School administrators ordered an evacuation of the school on 


24 June 6, 2007. 


h). On June 7, 2007, Timberline High School received an e-mail from 
fromitalv@gmail . com. ” The UNSUB(s) states: i' 


Affidavit of Norm Sanders for CIPAV 
USAO# 2007R00791 


Page 8 of 17 Pages 



w 


1 


8 


* 

“There are 3 bombs planted in the school and fliey’re all different 
kinds. I have premade these weeks in advance and tested the timers 
to m^e sure they work to exact millis^ond. Locking the doors is 
a good plan, but too late. ” 


0 


School administrators ordered an evacuation of the school on 


June 7, 2007.. 
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j)* On June. 7, 2007, the UNSUB(s) posted three of the threatening 

e-mails in the comments section of the online news publication service, **theolympian”. 
The administrator from theolympian.com” removed the threatening e-mail postings. 

Shortly thereafter, the UNSUB(s) re-posted the threatening e-mails. Eventually, the 

» 

administrator of “dieolympian.com** disabled the “Comments” section. 




k). On June 7, 2007, Detective Jeremy Knight, Lacey Police 
Department (LPD), received information from the Thurston County Sheriffs Office, 

4 

which had revealed a complamt from a person identified as AG. AG stated diat she 
received an invitation through myspace.com from the MySpace. profile of 

X 

* 

“Timberlinebombinfo” wanting her to post a URL link to 

I 

http;//bombermails.hvDerphp.com on her myspace.com webpage. The UNSUB(s) 


f 


advised her that failure R> comply would result in her name being associated with future 
bomb threats. SimUarly, Knight received a phone call from a parent alleging that her 
son received the same request from the UNSUB(s). According to Knight, 33 students 
received a request from die UNSUB(s) to post the link on dieir respective myspace.com 

I 

webpages. Subsequent interviews performed by Kni g ht yielded limited information. 


1). On June 7, 2007, VW and BP received MySpace private invitations 

n 

from an individual utilizing the MySpace moniker “Timberlinebombinfo”. VW 

» 

accepted the invitation from “Timberlinebombinfo’* and received an America Online 

i 

Instant Message (AIM) from an individual utilizing AIM screen name 
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1 11“ Alexspi3ring_09. ** Communication ceased with “ Alexspi3ring^09" after VW 

2 Irequested additional information related to the bomb threats. VW believed screen name 

3 “Alexspi3ring_09" was associated to ALEX SPIERING, a stiident at Timberline High. 

4 School. VW stated “Alexspi3riiig_09" and “Timberlinebombinfo” used to have die 

5 identical graphic on their MySpace webpage. “Timberlinebombinfo” recently changed 

6 his/her graphic ftom a picture of guns to a picture of a bomb. 


8 m). On June 7, 2007, Thurston County School District reported ALEX 

9 SPIERING resides at 6133 Winnwood Loop SE, Olympia, WA, 98513, telephone (360) 


10 1455-0569, date of birth 


19S. 


12 


IS 


16 


17 


18 


19 


20 


24 


25 


n). On June 8, 2007, Comcast Internet, Thorofare, New Jersey, 


13 reported that residential address 6133 Winnwood Loop SE, Olympia, WA, 98513 

14 received Comcast Internet services for the following subscriber: 


Sara Spiering 

6133 Winnwood Loop SE, Lacey, WA 98513 
Telephone (360) 455-0569 
Dynamically Assigned Active Account 
Account Number; 8498380070269681 


o). On June 8, 2007, Thurston County School District received two 


22 Hadditional bomb threat e-mails 


23 (the evacuation of the Timberline High School. 



resulted in 


12. On June 4, 2007, Google provided subscriber, registration, and IP Address 


26 log history for e-mail address “dou^briggsli: 

27 Status: Enabled (user deleted account) 

28 Services ; Talk, Search History , Gmail 
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Name: Doug Briggs 
Secondary Email: 

Created on: 03-Jun*2007 

Lang: en 

IP: 80.76.80.103 

LOGS: All times are displayed in UTC/GMT 


IP 

81.27.207.243 
80.76.80.103 
80.76.80.103 

a). On June 6, 2007, a SmartWhoIs lookup of IP Address 80.76.80. 103 
resolved to Sonic S.R.L, Via S.Rocco I, 24064, Gnimello Del Monte, Italy, 

Phone: +390354491296, E-mail: Staff@sonlc.it. Your affiant connected to 

. • ^ 

http://sonic.it. which displayed an Italian business webpage for Sonic SRL Internet- 



.com 


Date/Time 


04-Jun-2007 05:47:29 am 
04-Jun-2007 05:43:14 am 
03-Jun-2007 06:19:44 am 



Service Provider. 


4 


18 

19 
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b)* On June 7, 2007, a request to MySpace for subscriber and IP 

• ♦ 

Address logs for MySpace user “Timberlinebombinfo “ provided the follow mg results: 


User ID: 

199219316 

i 

First Name: 

Doug 

Last Name: 

Briggs 

Gender: 

• 

Male 

Date of Birth : 

12/10/1992 

Age: 

14 

Country: 

US 

City: 

Lacey 
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Postal Code: 
Region: 

r 

Email Address: 

♦ 

User Name : 

Sign up IP Address; 
Sign up Date: 

Delete Date: 

Login Date 

o 


985003 

« 

Western Australia 
timberline. sucks@gmail .com 
timberlinebombinfo 
80.76.80.103 

♦ 

June 7, 2007 7:49PM 

N/A 

June 7, 2007 7:49:32:247 PM IP Address 80.76.80. 103 


c). 


FBI Seattle Division contacted FBI Legate Attache Rome, Italy and 


an official request was provided the Italian National Police requesting assistance in 
contacting Sonic SRL and locating the compromised computer utilizing IP Address 


80.76.80.103. 




d). On June 7, 2007, the System Administrator for the 

* » 

www.theQlvmDian.com advised the posting of the bomb threat e-mails originated from 


SmartWhois 


The 


National Institute of Nuclear Physics (INFN), LNL - Laboratori Nazionali di Legnaro, 


Italy”. 


13. Based on my training, experience, and the investigation described herein, I 


know the following among other things: 


a). that network level messages, including the originating IP address 

22 land MAC address, other variables, and cermin registry-type iufoimation of a computer 

23 lean be used to assist in identifying the individual(s) using that computer; and 


24 


25 


26 


27 


28 


b). the individual(s) using the aforementioned activated computer 

! 

Utilized compromised computers to conceal their true originating IP address and thereby 

i 

1 

intentionally inhibiting the individuals) ' identification. Compromised computers are 
generally infected with computer viruses, trojans, or other malevolent programs, which 

r 

can allow a user the abili^ to control computer(s) on the Internet or particular services 
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I of compromised computer(s) without authorization. It is conimon for individuals 
engaged in illegal activity to access and control compromised computer(s) to perform 
malicious acts in order to conceal their originating IP addresses ^ 

14. Based on training, experience, and the investigation described herein, I 
have concluded that using a CIPAV on the target MySpace “Timberlinebombinfo” 
account may assist the FBI to determine the identities of the individual(s) using the 
activating computer. A CIP A V^s activation will cause the activating computer to send 
network level messages, including the activating computer's origmating IP address and 
MAC address, other variables, and certain registry- type information. This information 
may assist the FBI in identifying the individual(s) using the activating computers. 

15. The CIPAV will be deployed through an electronic messaging program 
from an account controlled by the FBI. The computers sending and receiving the 
CIPAV data will be machines controlled by the FBI. The electronic message deploying 
the CIPAV will only be directed to the administrator(s) of the ‘‘Timberlinebombinfo” 
account. 


a) . 

b) . 

c) . 

d) . 


Electronic messaging accounts commonly require a unique user 
name and password. 

Once the CIPAV is successfully deployed, it will conduct a one- 
time search of the activating computer and capture the information 
described in paragraph seven. 

The captured information will be forwarded to a computer 
controlled by the FBI located within the Eastern District of 
Virginia. 

After the one-time search, the CIPAV will function as a pen register 

« 

device and record the routing and destination addressing information 
for electronic communications originating from the activating 
computer. 
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e). The pen register will record IP address, dates, and times of the 

• 

electronic commimicatioeis, but not the contents of such 
communications or the contents contained on the computer, and 
forward the IP address data to a computer controlled by the 
FBI, for a period of (60) days. 


10 


11 


12 


13 


14 


15 


16 


17 


18 


CONCLUSION 

16. Based upon my review of the evidence, my training and experience, and 
information I have gathered from various computer experts, I have probable cause to 

9 

believe that deploying a CIPA V in an electronic message direct^ to the admmistrator(s) 

of the MySpace ‘'Timberlinebombinfo” account will assist in identifying a computer and 

« 

individual(s) using the computer to transmit bomb threats and related communications in 
violation of Title 18, United States Code Sections 875(c) and 1 030(a)(5)(A)(i) and 
(B)(iv). 

17. Because notice as required by Federal Rule of Criminal Procedure 

♦ 

41(f)(3) would jeopardize the success of the investigation, and because the investigation 
has not identifled an appropriate person to whom such notice can be given, I hereby 
request authorization to delay such notice until an appropriate person is identified. 

19 HFurther, assuming providing notice would still jeopardize the investigation after an 

20 nappropriate person to receive notice is identified, I request permission to ask this Court 
2! |to authorize an additional delay in notification. In any event, the United States 

22 |govenunent will notify this Court when it identifies an appropriate person to whom to 

23 jjgive notice, so diat this Court may determine whether notice shall be given at that time. 

18. Because there are legitimate law enforcement interests that justify an 

♦ 

unannounced use of the CIPA V and review of the messages generated by the activating 


24 


25 


26 


27 


28 
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computer in this case,^ I ask this Court to authorize the proposed use of a CIPAV 
widiout the prior announcement of its use. One of these legitimate law enforcement 
interests is that announcing the use of the CIPAV would assist a person controlling the 
activating con^)uter(s) to evade revealing its tnie IP address, other variables, and certain 
registry'type information - thereby defeating the ClPAV’s purpose. 

19. Rule 41(e)(2) requires that (A) the warrant command the FBI "to execute 

the warrant widiin a specified time no longer dian iO days" and (B) "execute the 

' • 

warrant during the daytime unless the judge for good cause expressly authorizes 
execution, at another time. . . " In order to comply with Rule 41 , the Government will 
only deploy CIPAV between the hours of 6:00 a.m. and 10:00 p.m. (PST) during an 
initial 10-day period. However, the Government seeks permission to read any messages 
generated by the activating computer as a result of a CIPAV at any time of day or night 

during the initial 10-day period. This is because the individuals using the activating 

< 

computer may activate the CIPAV after 10:00 p.m. or before 6:00 a.m., and law 
enforcement would seek to read the information it receives as soon as it is aware of die 
CIPAV response given the emergent nature of this investigation. If the CIPAV is not 

I 

activated within die mitial 10-day period, the Government will seek further authorization 
from the Court to read any information sent to the computer controlled by the FBI as a 

I 

result of that CIPAV after the 10* day from the date the Court audiorizes die use of the 
first CIPAV. 

# 

20. Because the FBI cannot predict whether any particular formulation of a 

4 • 

CIPAV to be used will cause a person($) controlling the activating computer to activate 
a CIPAV, I request that this Court authori^ the FBI to continue using additional 
CIPAV's in conjunction with the target MySpace account (for up to 10 days after this 

k 

■ 

warrant is authorized), until a CIPAV has been activated by the activating con^iuter. 


.See Wilson v, Arkansas. 514 U.S. 927, 936 (1995) (recognizing that “law enforcement 
interests may . . . establish the reasonableness of an unannounced entry.”) 


4 
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21. Accordingly, it is respectfully requested that this Court issue a search 
warrant authorizing the following: 

a) . the use of multiple CIPAVs until one CIPAV is activated by the 

■ 

activating computer in conjunction with the target MySpace “Timberlinebombinfo” 
account, without prior announcement, within 10 days from the date this Court authorizes 
the use of the first CIPAV ; 

b) . the CIPAV may cause an acdvatihg computer - wherever located - 

to send network levd messages containing the activating computer’s IP address, and/or 

MAC address, and/or other variables, and/or certain registry-type infbnnation to a 

• « 

computer controlled by the FBI and located within the Eastern District of Virginia; 

c) . that the FBI may receive and read, at any time of day or night, 

within 10 days from the date the Court authorizes of use of the CIPAV, the information 

that any CIPAV causes to be sent to the computer controlled by the FBI; 

« 

d) . that once the FBI has received an initial CIPAV response from the 

« 

* 

activating computer consisting of network level messages containing the activating 
computer’s IP address, and/or MAC address, and/or other variables, and/or certain 

registry-type information, the FBI will thereafter only be collecting the types of 

« 

! 

^dressing and routing information that can be collected pursuant to a pen register 


order; and 


e). that, pursuant to 18 U.S.C. §3103a(b)(3), to satisfy the notification 




requirement of Federal Rule of Criminal Procedure 41(f)(3), the FBI may delay 
providing a copy of the search warrant and the receipt for any property taken until no 
more than thirty (30) days after such time as the name and location of the individual(s) 
using the activating conqmter is positively identified or a latter date as the court may, 
for good Cause shown, authorize. Provision of a copy of the search warrant and receipt 
may, in addition to any other methods allowed by law, be effectuated by electronic 
delivery of true and accurate electronic copies (e.g. Adobe PDF file) of the fully 
executed documents. 
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22 . It is further requested that this Application and the related documents be 
nied under seal. The information to be obtained is relevant to an on-going investigation. 
Premature disclosure of this Application and related documents may jeopardize the 
success of the above-described investigation. 

WHEREFORE, Affiant respectfully requests that a warrant be issued authorizing 

« 

the FBI to utilize a CIPA V and receive the attendant information according to the terms 

I 

set forth in this Affidavit. 


10 


u 


12 


13 


14 


15 


16 


17 


18 


19 


20 


21 


22 


23 


24 


THIS APPLICATION DOES NOT SEEK AUTHOMZATION TO OBTAIN 
THE CONTENT OF ANY ELECTRONIC COMMUNICATIONS, AND THE 
WARRANT WILL SO SPECIFY. 

Q-iL. 

rmanB.' Sanders 


Sworn m and subscribed before 

/2-~^ day of June, 2007 



cial Agent 

eral Bureau of Investigation 



bononue 


ames 

States Magistrate Judge 
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